You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, GraphQL queries are unlimited in depth and complexity. It is possible to request all blocks with all transactions and receipts in one query causing OOM on the fuel-core node(plus it consumes a lot of execution).
Solution
We need to implement limits on the complexity and depth of graphql queries to protect the APIs from DOS attacks. This will need to be done carefully, ensuring that the SDK isn't rendered unusable by excessive limits.
Overview
Currently, GraphQL queries are unlimited in depth and complexity. It is possible to request all blocks with all transactions and receipts in one query causing OOM on the
fuel-core
node(plus it consumes a lot of execution).Solution
We need to implement limits on the complexity and depth of graphql queries to protect the APIs from DOS attacks. This will need to be done carefully, ensuring that the SDK isn't rendered unusable by excessive limits.
Implementation details
https://async-graphql.github.io/async-graphql/en/depth_and_complexity.html
The text was updated successfully, but these errors were encountered: